Non-interactive User Sign-in Logs

OperationName	Description	Sample	Rule
any	Any record in this table with no specific result or signal bucket filter. Every record carries OperationName = "Sign-in activity"; detections pivot on field values, not a per-action discriminator.	Y	Y
Success	Record with ResultType 0: the non-interactive sign-in (a token refresh or cached-token client request) completed successfully.	Y	Y
Invalid-credentials	Record with ResultType 50126 (bad username or password) or 50056 (null password): a non-interactive client presented invalid credentials, for example a legacy mail client retrying a stale cached password.	N	Y
Account-locked	Record with ResultType 50053: Microsoft Entra Smart Lockout engaged after repeated sign-in failures on the account.	N	Y
Password-expired	Record with ResultType 50055: the account's password has expired.	N	Y
Disabled	Record with ResultType 50057: sign-in attempted against a disabled account.	N	Y
MFA-challenged	Record with ResultType 50074, 50076, 500121, 50079, 50072, or 53004: the flow required MFA and the client did not present a valid MFA claim.	N	Y
Blocked-by-CA	Record with ResultType 53003, 53000, 53001, 53002, 50131, 50158, or 50097: a Conditional Access policy returned a block decision for the sign-in. Code 50158 (external security challenge not satisfied) can accompany either a passed or a failed challenge, so on its own it is not conclusive of a block.	N	N
Other	Record whose ResultType is not one of the codes this catalog materializes as its own bucket.	Y	Y
Identity Protection (risk)	Record carrying a populated Identity Protection risk field (RiskState, RiskLevelDuringSignIn, RiskLevelAggregated, or RiskDetail). Populated only when Identity Protection is licensed (Microsoft Entra ID P2).	Y	N
Target application	Record carrying AppDisplayName, AppId, or ResourceDisplayName: the application and OAuth resource the cached-token or client-credential request targeted.	Y	Y
Authentication requirement	Record carrying AuthenticationRequirement (multiFactorAuthentication or singleFactorAuthentication): whether an MFA step was required for the flow.	Y	Y
Conditional Access status	Record carrying ConditionalAccessStatus: the status of every Conditional Access policy related to the sign-in.	Y	N
Client app (legacy authentication)	Record carrying ClientAppUsed: app auth details distinguishing legacy clients (Exchange ActiveSync and other older clients) from modern browser-based clients.	Y	N

any: Sign-in record (AADNonInteractiveUserSignInLogs, any result)

Description

Any record in this table with no specific result or signal bucket filter. Every record carries OperationName = "Sign-in activity"; detections pivot on field values, not a per-action discriminator.

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppDisplayName": "O365 Demeter",
  "AppId": "982bda36-4632-4165-a46a-9863b1bbcf7d",
  "AppOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "AppliedEventListeners": "None",
  "AuthenticationContextClassReferences": [],
  "AuthenticationDetails": [
    {
      "authenticationStepDateTime": "2026-07-25T15:55:22.4071391+00:00",
      "authenticationMethod": "Previously satisfied",
      "authenticationMethodDetail": "",
      "succeeded": true,
      "authenticationStepResultDetail": "MFA requirement satisfied by claim in the token",
      "authenticationStepRequirement": ""
    }
  ],
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Oauth Scope Info",
      "value": [
        "user_impersonation"
      ]
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "False"
    }
  ],
  "AuthenticationProtocol": "none",
  "AuthenticationRequirement": "multiFactorAuthentication",
  "AuthenticationRequirementPolicies": [
    {
      "requirementProvider": "securityDefaults",
      "detail": "Security Defaults"
    }
  ],
  "AutonomousSystemNumber": "64512",
  "Category": "NonInteractiveUserSignInLogs",
  "ClientAppUsed": "Browser",
  "ClientCredentialType": "clientAssertion",
  "ConditionalAccessAudiences": [
    "982bda36-4632-4165-a46a-9863b1bbcf7d",
    "1514f0a7-c9d3-4ce3-9048-73e754767b8d"
  ],
  "ConditionalAccessPolicies": [
    {
      "id": "SecurityDefaults",
      "displayName": "Security Defaults",
      "enforcedGrantControls": [
        "Mfa"
      ],
      "result": "success",
      "conditionsSatisfied": 3,
      "conditionsNotSatisfied": 0
    }
  ],
  "ConditionalAccessPoliciesV2": "None",
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "224035f5-5660-456a-80ae-e0bb9fa87a15",
  "CreatedDateTime": "2026-07-25T15:55:22.4071391Z",
  "CrossTenantAccessType": "none",
  "DeviceDetail": {
    "deviceId": "",
    "operatingSystem": "MacOs",
    "browser": "Rich Client 203.0.113.10",
    "isCompliant": false,
    "isManaged": false
  },
  "DurationMs": "0",
  "HomeTenantId": "11111111-1111-1111-1111-111111111111",
  "IPAddress": "2001:db8::10",
  "Id": "6d296213-4cca-4ae0-82fd-b5fa816e1f00",
  "Identity": "Admin User",
  "IncomingTokenType": "none",
  "IsInteractive": "False",
  "IsRisky": "None",
  "IsTenantRestricted": "False",
  "IsThroughGlobalSecureAccess": "False",
  "Location": "US",
  "LocationDetails": {
    "city": "Redacted",
    "state": "Redacted",
    "countryOrRegion": "US",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "OriginalRequestId": "6d296213-4cca-4ae0-82fd-b5fa816e1f00",
  "OriginalTransferMethod": "none",
  "ProcessingTimeInMs": "101",
  "ResourceDisplayName": "M365 Commerce Management",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceIdentity": "1514f0a7-c9d3-4ce3-9048-73e754767b8d",
  "ResourceTenantId": "11111111-1111-1111-1111-111111111111",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "RiskDetail": "none",
  "RiskEventTypes": [],
  "RiskLevelAggregated": "none",
  "RiskLevelDuringSignIn": "none",
  "RiskState": "none",
  "ServicePrincipalId": "f3a67490-8317-417b-b3e6-3aa07d654618",
  "SessionId": "0022840a-e4ab-884c-587f-d20d24637227",
  "SessionLifetimePolicies": [],
  "SignInEventTypes": [
    "nonInteractiveUser"
  ],
  "Status": {
    "errorCode": 0,
    "additionalDetails": "MFA requirement satisfied by claim in the token"
  },
  "TokenIssuerType": "AzureAD",
  "TokenProtectionStatusDetails": {
    "signInSessionStatus": "none",
    "signInSessionStatusCode": 1002
  },
  "UniqueTokenIdentifier": "E2IpbcpM4EqC_bX6gW4fAA",
  "UserDisplayName": "Admin User",
  "UserId": "aaaaaaaa-0000-0000-0000-000000000001",
  "UserPrincipalName": "adminuser@example.onmicrosoft.com",
  "UserType": "Member"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`event.outcome` (elastic rule field)	eq	`success`	16 rules	elastic
`azure_ad::user_type` (elastic rule field)	eq	`member`	10 rules	elastic
`EventType` (elastic rule field)	eq	`sign-in activity`	7 rules	elastic
`azure_ad::app_id` (elastic rule field)	eq	`29d9ed98-a469-4536-ade2-f981bc1d605e`	5 rules	elastic
`Active` (kusto rule field)	eq	`true`	4 rules	kusto
`SigninLogs_TimeGenerated` (kusto rule field)	cross_field_compare	`ExpirationDateTime`	4 rules	kusto
`azure_ad::resource_id` (elastic rule field)	eq	`00000002-0000-0000-c000-000000000000`	3 rules	elastic
`azure_ad::resource_id` (elastic rule field)	in	`00000003-0000-0000-c000-000000000000`	4 rules	elastic
`security_result.action (Chronicle)`	eq	`ALLOW`	4 rules	chronicle
`ActivityType` (kusto rule field)	in	`FailedLogOn`	3 rules	kusto
`ActivityType` (kusto rule field)	in	`LogOn`	3 rules	kusto
`azure_ad::authentication_protocol` (elastic rule field)	eq	`devicecode`	3 rules	elastic
`azure_ad::authentication_requirement` (elastic rule field)	eq	`singlefactorauthentication`	3 rules	elastic
`azure_ad::user_principal_name` (elastic rule field)	is_not_null		3 rules	elastic
`user` (kusto rule field)	is_not_null		3 rules	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

M365 or Entra ID Identity Sign-in from a Suspicious Source source high: This rule correlate Entra-ID or Microsoft 365 mail successful sign-in events with network security alerts by source address. Adversaries may trigger some network security alerts such as reputation or other anomalies before accessing cloud resources.T1078
Entra ID Sharepoint or OneDrive Accessed by Unusual Client source medium: Identifies when an application accesses SharePoint Online or OneDrive for Business for the first time in the tenant within a specified timeframe. This detects successful OAuth phishing campaigns, illicit consent grants, or compromised third-party applications gaining initial access to file storage. Adversaries often use malicious OAuth applications or phishing techniques to gain consent from users, allowing persistent access to organizational data repositories without traditional credential theft.T1078, T1078.004, T1098, T1098.001, T1213, T1213.002
Entra ID OAuth Device Code Flow with Concurrent Sign-ins source high: Identifies Entra ID device code authentication flows where multiple user agents are observed within the same session. This pattern is indicative of device code phishing, where an attacker's polling client (e.g., Python script) and the victim's browser both appear in the same authentication session. In legitimate device code flows, the user authenticates via browser while the requesting application polls for tokens - when these have distinctly different user agents (e.g., Python Requests vs Chrome), it may indicate the code was phished and redeemed by an attacker.T1078, T1078.004, T1528, T1566, T1566.002

Show 17 more (31 total) on the rules page

Splunk #

Azure AD AzureHound UserAgent Detected source: This detection identifies the presence of the default AzureHound user-agent string within Microsoft Graph Activity logs and NonInteractive SignIn Logs. AzureHound is a tool used for gathering information about Azure Active Directory…T1087, T1087.004, T1526
Detect Distributed Password Spray Attempts source: This analytic employs the 3-sigma approach to identify distributed password spray attacks. A distributed password spray attack is a type of brute force attack where the attacker attempts a few common passwords against many different…T1110, T1110.003
Azure AD Multi-Source Failed Authentications Spike source: The following analytic detects potential distributed password spraying attacks in an Azure AD environment. It identifies a spike in failed authentication attempts across various user-and-IP combinations from multiple source IPs and…T1110, T1110.003, T1110.004, T1586, T1586.003

Show 1 more (4 total) on the rules page

Kusto #

IP with multiple failed Microsoft Entra ID logins successfully logs in to Palo Alto VPN source medium: This query creates a list of IP addresses with the number of failed login attempts to Entra ID above a set threshold ( default of 5 ). It then looks for any successful Palo Alto VPN logins from any of these IPs within the same timeframe.T1078, T1110
Authentication Attempt from New Country source medium: Detects when there is a login attempt from a country that has not seen a successful login in the previous 14 days. Threat actors may attempt to authenticate with credentials from compromised accounts - monitoring attempts from anomalous locations may help identify these attempts. Authentication attempts should be investigated to ensure the activity was legitimate and if there is other similar activity. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-failed-unusual-sign-insT1078, T1078.004
User agent search for log4j exploitation attempt source high: This query uses various log sources having user agent data to look for log4j CVE-2021-44228 exploitation attempt based on user agent pattern. Log4j is an open-source Apache logging library that is used in many Java-based applications. The regex and the string matching look for the most common attacks. This might not be comprehensive to detect every possible user agent variation. Reference: https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/T1190

Show 17 more (33 total) on the rules page

YARA-L #

Entra ID Admin Login Activity to Uncommon MS Cloud Apps source medium: Detects Azure AD admin login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by defaultT1078, T1078.004
Microsoft Entra ID Device code phishing attack source high: Detects strong indicators of a successful device code phishing attack.T1566
Entra ID Login Activity to Azure AD PowerShell Application source medium: Logins to Azure AD PowerShell app can have legitimate purposes, but are also abused to gain access to user information. Programatic access to Azure AD should generally be through other apps

Show 2 more (5 total) on the rules page

Panther #

Microsoft Entra ID First Time Seen Device Code Authentication source: Detects when users authenticate via device code flow for the first time in the past 14 days. Device code flow can be exploited through phishing attacks to steal tokens and impersonate victims. This baseline detection helps identify new device code usage patterns that may indicate account compromise.
Azure Device Code Authentication with Broker Client source medium: Detects device code authentication using the Microsoft Broker Client application, which may indicate Primary Refresh Token (PRT) abuse. Device code flow allows adversaries to trick users into entering codes on attacker-controlled applications. When combined with Microsoft Broker Client (app ID 29d9ed98-a469-4536-ade2-f981bc1d605e), this may indicate PRT theft or replay attacks that bypass MFA and Conditional Access policies.T1078, T1078.004, T1550, T1550.001, T1566, T1566.002
Azure Excessive Account Lockouts source high: Detects high volumes of failed Microsoft Entra ID sign-in attempts resulting in account lockouts, indicating potential brute-force credential attacks such as password spraying, password guessing, or credential stuffing. When adversaries repeatedly attempt authentication with incorrect credentials, Entra ID Smart Lockout policies trigger account lockouts (error code 50053).T1110, T1110.001, T1110.003, T1110.004

Show 9 more (12 total) on the rules page

Success: Successful sign-in

Description

Record with ResultType 0: the non-interactive sign-in (a token refresh or cached-token client request) completed successfully.

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppDisplayName": "O365 Demeter",
  "AppId": "982bda36-4632-4165-a46a-9863b1bbcf7d",
  "AppOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "AppliedEventListeners": "None",
  "AuthenticationContextClassReferences": [],
  "AuthenticationDetails": [
    {
      "authenticationStepDateTime": "2026-07-25T15:55:22.4071391+00:00",
      "authenticationMethod": "Previously satisfied",
      "authenticationMethodDetail": "",
      "succeeded": true,
      "authenticationStepResultDetail": "MFA requirement satisfied by claim in the token",
      "authenticationStepRequirement": ""
    }
  ],
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Oauth Scope Info",
      "value": [
        "user_impersonation"
      ]
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "False"
    }
  ],
  "AuthenticationProtocol": "none",
  "AuthenticationRequirement": "multiFactorAuthentication",
  "AuthenticationRequirementPolicies": [
    {
      "requirementProvider": "securityDefaults",
      "detail": "Security Defaults"
    }
  ],
  "AutonomousSystemNumber": "64512",
  "Category": "NonInteractiveUserSignInLogs",
  "ClientAppUsed": "Browser",
  "ClientCredentialType": "clientAssertion",
  "ConditionalAccessAudiences": [
    "982bda36-4632-4165-a46a-9863b1bbcf7d",
    "1514f0a7-c9d3-4ce3-9048-73e754767b8d"
  ],
  "ConditionalAccessPolicies": [
    {
      "id": "SecurityDefaults",
      "displayName": "Security Defaults",
      "enforcedGrantControls": [
        "Mfa"
      ],
      "result": "success",
      "conditionsSatisfied": 3,
      "conditionsNotSatisfied": 0
    }
  ],
  "ConditionalAccessPoliciesV2": "None",
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "224035f5-5660-456a-80ae-e0bb9fa87a15",
  "CreatedDateTime": "2026-07-25T15:55:22.4071391Z",
  "CrossTenantAccessType": "none",
  "DeviceDetail": {
    "deviceId": "",
    "operatingSystem": "MacOs",
    "browser": "Rich Client 203.0.113.10",
    "isCompliant": false,
    "isManaged": false
  },
  "DurationMs": "0",
  "HomeTenantId": "11111111-1111-1111-1111-111111111111",
  "IPAddress": "2001:db8::10",
  "Id": "6d296213-4cca-4ae0-82fd-b5fa816e1f00",
  "Identity": "Admin User",
  "IncomingTokenType": "none",
  "IsInteractive": "False",
  "IsRisky": "None",
  "IsTenantRestricted": "False",
  "IsThroughGlobalSecureAccess": "False",
  "Location": "US",
  "LocationDetails": {
    "city": "Redacted",
    "state": "Redacted",
    "countryOrRegion": "US",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "OriginalRequestId": "6d296213-4cca-4ae0-82fd-b5fa816e1f00",
  "OriginalTransferMethod": "none",
  "ProcessingTimeInMs": "101",
  "ResourceDisplayName": "M365 Commerce Management",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceIdentity": "1514f0a7-c9d3-4ce3-9048-73e754767b8d",
  "ResourceTenantId": "11111111-1111-1111-1111-111111111111",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "RiskDetail": "none",
  "RiskEventTypes": [],
  "RiskLevelAggregated": "none",
  "RiskLevelDuringSignIn": "none",
  "RiskState": "none",
  "ServicePrincipalId": "f3a67490-8317-417b-b3e6-3aa07d654618",
  "SessionId": "0022840a-e4ab-884c-587f-d20d24637227",
  "SessionLifetimePolicies": [],
  "SignInEventTypes": [
    "nonInteractiveUser"
  ],
  "Status": {
    "errorCode": 0,
    "additionalDetails": "MFA requirement satisfied by claim in the token"
  },
  "TokenIssuerType": "AzureAD",
  "TokenProtectionStatusDetails": {
    "signInSessionStatus": "none",
    "signInSessionStatusCode": 1002
  },
  "UniqueTokenIdentifier": "E2IpbcpM4EqC_bX6gW4fAA",
  "UserDisplayName": "Admin User",
  "UserId": "aaaaaaaa-0000-0000-0000-000000000001",
  "UserPrincipalName": "adminuser@example.onmicrosoft.com",
  "UserType": "Member"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`ResultType` (kusto rule field)	eq	`0`	4 rules	kusto
`ResultType` (kusto rule field)	in	`0`	1 rule	kusto
`ResultType` (kusto rule field)	in	`50074`	1 rule	kusto
`ResultType` (kusto rule field)	in	`50076`	1 rule	kusto
`AppId` (kusto rule field)	is_not_null		2 rules	kusto
`Anomalies` (kusto rule field)	gt	`0`	1 rule	kusto
`action` (splunk rule field)	eq	`success`	1 rule	splunk
`azure.signinlogs.properties.device_detail.is_managed` (elastic rule field)	ne	`true`	1 rule	elastic
`azure.signinlogs.properties.incoming_token_type` (elastic rule field)	eq	`primaryRefreshToken`	1 rule	elastic
`azure.signinlogs.properties.incoming_token_type` (elastic rule field)	eq	`refreshToken`	1 rule	elastic
`azure.signinlogs.properties.is_interactive` (elastic rule field)	eq	`true`	1 rule	elastic
`azure.signinlogs.properties.token_protection_status_details.sign_in_session_status` (elastic rule field)	eq	`unbound`	1 rule	elastic
`azure.signinlogs.result_signature` (elastic rule field)	eq	`SUCCESS`	1 rule	elastic
`azure_ad::app_id` (elastic rule field)	eq	`29d9ed98-a469-4536-ade2-f981bc1d605e`	1 rule	elastic
`azure_ad::resource_display_name` (elastic rule field)	ne	`Device Registration Service`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Entra ID AiTM Phishing-Kit Chain Detected source high: Identifies a Microsoft Entra ID identity-compromise chain in which a single user, within a 10-minute window, authenticates to the Device Registration Service through the Microsoft Authentication Broker (MAB) client, registers a device, and then uses the resulting Primary Refresh Token (PRT) to access a resource other than the Device Registration Service. This sequence is the core post-adversary-in-the-middle (AiTM) persistence pattern used by phishing kits such as Tycoon2FA and Kali365: after capturing a victim session, the kit registers an Azure AD-joined device to obtain a device-bound PRT, which survives user-level session revocation and password resets and grants trusted, MFA-free access. Correlating the broker sign-in, the device-registration audit event, and the follow-on PRT sign-in for the same user within a short window is a high-fidelity indicator of active account takeover.T1078, T1078.004, T1098, T1098.005, T1528, T1550↳ also matches Target application: Sign-in naming a target application

Splunk #

Azure AD Concurrent Sessions From Different Ips source: The following analytic detects an Azure AD account with concurrent sessions originating from multiple unique IP addresses within a 5-minute window. It leverages Azure Active Directory NonInteractiveUserSignInLogs to identify this behavior…T1185

Kusto #

Cisco - firewall block but success logon to Microsoft Entra ID source medium: Correlate IPs blocked by a Cisco firewall appliance with successful Microsoft Entra ID signins. Because the IP was blocked by the firewall, that same IP logging on successfully to Entra ID is potentially suspect and could indicate credential compromise for the user account.T1078↳ also matches MFA-challenged: Sign-in with an incomplete or failed MFA challenge
Microsoft Entra ID Rare UserAgent App Sign-in source medium: This query establishes a baseline of the type of UserAgent (i.e. browser, office application, etc) that is typically used for a particular application by looking back for a number of days. It then searches the current day for any deviations from this pattern, i.e. types of UserAgents not seen before in combination with this application.T1036
Microsoft Entra ID UserAgent OS Missmatch source medium: This query extracts the operating system from the UserAgent header and compares this to the DeviceDetail information present in Microsoft Entra ID.T1036

Show 2 more (5 total) on the rules page

Invalid-credentials: Sign-in with invalid credentials

Description

Record with ResultType 50126 (bad username or password) or 50056 (null password): a non-interactive client presented invalid credentials, for example a legacy mail client retrying a stale cached password.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::userAgent` (elastic rule field)	ne	`mozilla/5.0 (compatible; msal 1.0) pkeyauth/1.0`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120000`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120002`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120020`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50034`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50055`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50056`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50057`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50064`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50076`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50079`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50105`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50126`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50135`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50142`	2 rules	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Entra ID User Sign-in Brute Force Attempted source medium: Identifies potential brute-force attacks targeting user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to applications integrated with Entra ID or to compromise valid user accounts.T1110, T1110.001, T1110.003, T1110.004↳ also matches Password-expired: Sign-in blocked by expired password, Disabled: Sign-in attempted against a disabled account, MFA-challenged: Sign-in with an incomplete or failed MFA challenge, Other: Sign-in with another recorded result, Authentication requirement: Sign-in recording an authentication requirement
Entra ID Sign-in Brute Force Attempted (Microsoft 365) source medium: Identifies potential brute-force attacks targeting Microsoft 365 user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to Microsoft 365 services such as Exchange Online, SharePoint, or Teams.T1110, T1110.001, T1110.003, T1110.004↳ also matches Password-expired: Sign-in blocked by expired password, Disabled: Sign-in attempted against a disabled account, MFA-challenged: Sign-in with an incomplete or failed MFA challenge, Other: Sign-in with another recorded result, Target application: Sign-in naming a target application

Account-locked: Sign-in blocked by account lockout

Description

Record with ResultType 50053: Microsoft Entra Smart Lockout engaged after repeated sign-in failures on the account.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Entra ID Excessive Account Lockouts Detected source high: Identifies a high count of failed Microsoft Entra ID sign-in attempts as the result of the target user account being locked out. Adversaries may attempt to brute-force user accounts by repeatedly trying to authenticate with incorrect credentials, leading to account lockouts by Entra ID Smart Lockout policies.T1110, T1110.001, T1110.003, T1110.004↳ also matches Authentication requirement: Sign-in recording an authentication requirement

Password-expired: Sign-in blocked by expired password

Description

Record with ResultType 50055: the account's password has expired.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::userAgent` (elastic rule field)	ne	`mozilla/5.0 (compatible; msal 1.0) pkeyauth/1.0`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120000`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120002`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120020`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50034`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50055`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50056`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50057`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50064`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50076`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50079`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50105`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50126`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50135`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50142`	2 rules	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Entra ID User Sign-in Brute Force Attempted source medium: Identifies potential brute-force attacks targeting user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to applications integrated with Entra ID or to compromise valid user accounts.T1110, T1110.001, T1110.003, T1110.004↳ also matches Invalid-credentials: Sign-in with invalid credentials, Disabled: Sign-in attempted against a disabled account, MFA-challenged: Sign-in with an incomplete or failed MFA challenge, Other: Sign-in with another recorded result, Authentication requirement: Sign-in recording an authentication requirement
Entra ID Sign-in Brute Force Attempted (Microsoft 365) source medium: Identifies potential brute-force attacks targeting Microsoft 365 user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to Microsoft 365 services such as Exchange Online, SharePoint, or Teams.T1110, T1110.001, T1110.003, T1110.004↳ also matches Invalid-credentials: Sign-in with invalid credentials, Disabled: Sign-in attempted against a disabled account, MFA-challenged: Sign-in with an incomplete or failed MFA challenge, Other: Sign-in with another recorded result, Target application: Sign-in naming a target application

Disabled: Sign-in attempted against a disabled account

Description

Record with ResultType 50057: sign-in attempted against a disabled account.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::userAgent` (elastic rule field)	ne	`mozilla/5.0 (compatible; msal 1.0) pkeyauth/1.0`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120000`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120002`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120020`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50034`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50055`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50056`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50057`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50064`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50076`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50079`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50105`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50126`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50135`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50142`	2 rules	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Entra ID User Sign-in Brute Force Attempted source medium: Identifies potential brute-force attacks targeting user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to applications integrated with Entra ID or to compromise valid user accounts.T1110, T1110.001, T1110.003, T1110.004↳ also matches Invalid-credentials: Sign-in with invalid credentials, Password-expired: Sign-in blocked by expired password, MFA-challenged: Sign-in with an incomplete or failed MFA challenge, Other: Sign-in with another recorded result, Authentication requirement: Sign-in recording an authentication requirement
Entra ID Sign-in Brute Force Attempted (Microsoft 365) source medium: Identifies potential brute-force attacks targeting Microsoft 365 user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to Microsoft 365 services such as Exchange Online, SharePoint, or Teams.T1110, T1110.001, T1110.003, T1110.004↳ also matches Invalid-credentials: Sign-in with invalid credentials, Password-expired: Sign-in blocked by expired password, MFA-challenged: Sign-in with an incomplete or failed MFA challenge, Other: Sign-in with another recorded result, Target application: Sign-in naming a target application

MFA-challenged: Sign-in with an incomplete or failed MFA challenge

Description

Record with ResultType 50074, 50076, 500121, 50079, 50072, or 53004: the flow required MFA and the client did not present a valid MFA claim.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::userAgent` (elastic rule field)	ne	`mozilla/5.0 (compatible; msal 1.0) pkeyauth/1.0`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120000`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120002`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120020`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50034`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50055`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50056`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50057`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50064`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50076`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50079`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50105`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50126`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50135`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50142`	2 rules	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Entra ID User Sign-in Brute Force Attempted source medium: Identifies potential brute-force attacks targeting user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to applications integrated with Entra ID or to compromise valid user accounts.T1110, T1110.001, T1110.003, T1110.004↳ also matches Invalid-credentials: Sign-in with invalid credentials, Password-expired: Sign-in blocked by expired password, Disabled: Sign-in attempted against a disabled account, Other: Sign-in with another recorded result, Authentication requirement: Sign-in recording an authentication requirement
Entra ID Sign-in Brute Force Attempted (Microsoft 365) source medium: Identifies potential brute-force attacks targeting Microsoft 365 user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to Microsoft 365 services such as Exchange Online, SharePoint, or Teams.T1110, T1110.001, T1110.003, T1110.004↳ also matches Invalid-credentials: Sign-in with invalid credentials, Password-expired: Sign-in blocked by expired password, Disabled: Sign-in attempted against a disabled account, Other: Sign-in with another recorded result, Target application: Sign-in naming a target application

Kusto #

Cisco - firewall block but success logon to Microsoft Entra ID source medium: Correlate IPs blocked by a Cisco firewall appliance with successful Microsoft Entra ID signins. Because the IP was blocked by the firewall, that same IP logging on successfully to Entra ID is potentially suspect and could indicate credential compromise for the user account.T1078↳ also matches Success: Successful sign-in

Blocked-by-CA: Sign-in blocked by Conditional Access

Description

Record with ResultType 53003, 53000, 53001, 53002, 50131, 50158, or 50097: a Conditional Access policy returned a block decision for the sign-in. Code 50158 (external security challenge not satisfied) can accompany either a passed or a failed challenge, so on its own it is not conclusive of a block.

Other: Sign-in with another recorded result

Description

Record whose ResultType is not one of the codes this catalog materializes as its own bucket.

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppDisplayName": "Microsoft Office 365 Portal",
  "AppId": "00000006-0000-0ff1-ce00-000000000000",
  "AppOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "AppliedEventListeners": "None",
  "AuthenticationContextClassReferences": [],
  "AuthenticationDetails": [
    {
      "authenticationStepDateTime": "2026-07-25T15:54:33.8519838+00:00",
      "authenticationMethod": "Previously satisfied",
      "authenticationMethodDetail": "",
      "succeeded": true,
      "authenticationStepResultDetail": "MFA requirement satisfied by claim in the token",
      "authenticationStepRequirement": ""
    }
  ],
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "False"
    }
  ],
  "AuthenticationProtocol": "none",
  "AuthenticationRequirement": "multiFactorAuthentication",
  "AuthenticationRequirementPolicies": [
    {
      "requirementProvider": "securityDefaults",
      "detail": "Security Defaults"
    }
  ],
  "AutonomousSystemNumber": "64512",
  "Category": "NonInteractiveUserSignInLogs",
  "ClientAppUsed": "Browser",
  "ClientCredentialType": "clientAssertion",
  "ConditionalAccessAudiences": [
    "00000006-0000-0ff1-ce00-000000000000",
    "5837b17e-2290-43f1-aabd-c49dd6f02e78"
  ],
  "ConditionalAccessPolicies": [
    {
      "id": "SecurityDefaults",
      "displayName": "Security Defaults",
      "enforcedGrantControls": [
        "Mfa"
      ],
      "result": "success",
      "conditionsSatisfied": 3,
      "conditionsNotSatisfied": 0
    }
  ],
  "ConditionalAccessPoliciesV2": "None",
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "a2d3c0f9-46c3-4563-950c-1733d9f1d040",
  "CreatedDateTime": "2026-07-25T15:54:33.8519838Z",
  "CrossTenantAccessType": "none",
  "DeviceDetail": {
    "deviceId": "",
    "operatingSystem": "MacOs",
    "browser": "Rich Client 203.0.113.10",
    "isCompliant": false,
    "isManaged": false
  },
  "DurationMs": "0",
  "HomeTenantId": "11111111-1111-1111-1111-111111111111",
  "IPAddress": "2001:db8::10",
  "Id": "e3279fd7-150d-4b7a-9800-a83b18431100",
  "Identity": "Admin User",
  "IncomingTokenType": "none",
  "IsInteractive": "False",
  "IsRisky": "None",
  "IsTenantRestricted": "False",
  "IsThroughGlobalSecureAccess": "False",
  "Location": "US",
  "LocationDetails": {
    "city": "Redacted",
    "state": "Redacted",
    "countryOrRegion": "US",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "OriginalRequestId": "e3279fd7-150d-4b7a-9800-a83b18431100",
  "OriginalTransferMethod": "none",
  "ProcessingTimeInMs": "73",
  "ResourceDisplayName": "Profile Service PROD",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceIdentity": "5837b17e-2290-43f1-aabd-c49dd6f02e78",
  "ResourceTenantId": "11111111-1111-1111-1111-111111111111",
  "ResultDescription": "The service principal for resource '{identifier}' is disabled. This indicate that a subscription within the tenant has lapsed, or that the administrator for this tenant has disabled the application, preventing tokens from being issued for it.",
  "ResultSignature": "FAILURE",
  "ResultType": "500014",
  "RiskDetail": "none",
  "RiskEventTypes": [],
  "RiskLevelAggregated": "none",
  "RiskLevelDuringSignIn": "none",
  "RiskState": "none",
  "ServicePrincipalId": "a982479a-70f4-45cb-8790-6495238e4eed",
  "SessionId": "0022840a-e4ab-884c-587f-d20d24637227",
  "SessionLifetimePolicies": [],
  "SignInEventTypes": [
    "nonInteractiveUser"
  ],
  "Status": {
    "errorCode": 500014,
    "failureReason": "The service principal for resource '{identifier}' is disabled. This indicate that a subscription within the tenant has lapsed, or that the administrator for this tenant has disabled the application, preventing tokens from being issued for it.",
    "additionalDetails": "MFA requirement satisfied by claim in the token"
  },
  "TokenIssuerType": "AzureAD",
  "TokenProtectionStatusDetails": {
    "signInSessionStatus": "none",
    "signInSessionStatusCode": 1002
  },
  "UniqueTokenIdentifier": "158n4w0VekuYAKg7GEMRAA",
  "UserDisplayName": "Admin User",
  "UserId": "aaaaaaaa-0000-0000-0000-000000000001",
  "UserPrincipalName": "adminuser@example.onmicrosoft.com",
  "UserType": "Member"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::userAgent` (elastic rule field)	ne	`mozilla/5.0 (compatible; msal 1.0) pkeyauth/1.0`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120000`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120002`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`120020`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50034`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50055`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50056`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50057`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50064`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50076`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50079`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50105`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50126`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50135`	2 rules	elastic
`azure_ad::result_type` (elastic rule field)	in	`50142`	2 rules	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Entra ID User Sign-in Brute Force Attempted source medium: Identifies potential brute-force attacks targeting user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to applications integrated with Entra ID or to compromise valid user accounts.T1110, T1110.001, T1110.003, T1110.004↳ also matches Invalid-credentials: Sign-in with invalid credentials, Password-expired: Sign-in blocked by expired password, Disabled: Sign-in attempted against a disabled account, MFA-challenged: Sign-in with an incomplete or failed MFA challenge, Authentication requirement: Sign-in recording an authentication requirement
Entra ID Sign-in Brute Force Attempted (Microsoft 365) source medium: Identifies potential brute-force attacks targeting Microsoft 365 user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to Microsoft 365 services such as Exchange Online, SharePoint, or Teams.T1110, T1110.001, T1110.003, T1110.004↳ also matches Invalid-credentials: Sign-in with invalid credentials, Password-expired: Sign-in blocked by expired password, Disabled: Sign-in attempted against a disabled account, MFA-challenged: Sign-in with an incomplete or failed MFA challenge, Target application: Sign-in naming a target application

Identity Protection (risk): Sign-in with an Identity Protection risk assessment

Description

Record carrying a populated Identity Protection risk field (RiskState, RiskLevelDuringSignIn, RiskLevelAggregated, or RiskDetail). Populated only when Identity Protection is licensed (Microsoft Entra ID P2).

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppDisplayName": "O365 Demeter",
  "AppId": "982bda36-4632-4165-a46a-9863b1bbcf7d",
  "AppOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "AppliedEventListeners": "None",
  "AuthenticationContextClassReferences": [],
  "AuthenticationDetails": [
    {
      "authenticationStepDateTime": "2026-07-25T15:55:22.4071391+00:00",
      "authenticationMethod": "Previously satisfied",
      "authenticationMethodDetail": "",
      "succeeded": true,
      "authenticationStepResultDetail": "MFA requirement satisfied by claim in the token",
      "authenticationStepRequirement": ""
    }
  ],
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Oauth Scope Info",
      "value": [
        "user_impersonation"
      ]
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "False"
    }
  ],
  "AuthenticationProtocol": "none",
  "AuthenticationRequirement": "multiFactorAuthentication",
  "AuthenticationRequirementPolicies": [
    {
      "requirementProvider": "securityDefaults",
      "detail": "Security Defaults"
    }
  ],
  "AutonomousSystemNumber": "64512",
  "Category": "NonInteractiveUserSignInLogs",
  "ClientAppUsed": "Browser",
  "ClientCredentialType": "clientAssertion",
  "ConditionalAccessAudiences": [
    "982bda36-4632-4165-a46a-9863b1bbcf7d",
    "1514f0a7-c9d3-4ce3-9048-73e754767b8d"
  ],
  "ConditionalAccessPolicies": [
    {
      "id": "SecurityDefaults",
      "displayName": "Security Defaults",
      "enforcedGrantControls": [
        "Mfa"
      ],
      "result": "success",
      "conditionsSatisfied": 3,
      "conditionsNotSatisfied": 0
    }
  ],
  "ConditionalAccessPoliciesV2": "None",
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "224035f5-5660-456a-80ae-e0bb9fa87a15",
  "CreatedDateTime": "2026-07-25T15:55:22.4071391Z",
  "CrossTenantAccessType": "none",
  "DeviceDetail": {
    "deviceId": "",
    "operatingSystem": "MacOs",
    "browser": "Rich Client 203.0.113.10",
    "isCompliant": false,
    "isManaged": false
  },
  "DurationMs": "0",
  "HomeTenantId": "11111111-1111-1111-1111-111111111111",
  "IPAddress": "2001:db8::10",
  "Id": "6d296213-4cca-4ae0-82fd-b5fa816e1f00",
  "Identity": "Admin User",
  "IncomingTokenType": "none",
  "IsInteractive": "False",
  "IsRisky": "None",
  "IsTenantRestricted": "False",
  "IsThroughGlobalSecureAccess": "False",
  "Location": "US",
  "LocationDetails": {
    "city": "Redacted",
    "state": "Redacted",
    "countryOrRegion": "US",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "OriginalRequestId": "6d296213-4cca-4ae0-82fd-b5fa816e1f00",
  "OriginalTransferMethod": "none",
  "ProcessingTimeInMs": "101",
  "ResourceDisplayName": "M365 Commerce Management",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceIdentity": "1514f0a7-c9d3-4ce3-9048-73e754767b8d",
  "ResourceTenantId": "11111111-1111-1111-1111-111111111111",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "RiskDetail": "none",
  "RiskEventTypes": [],
  "RiskLevelAggregated": "none",
  "RiskLevelDuringSignIn": "none",
  "RiskState": "none",
  "ServicePrincipalId": "f3a67490-8317-417b-b3e6-3aa07d654618",
  "SessionId": "0022840a-e4ab-884c-587f-d20d24637227",
  "SessionLifetimePolicies": [],
  "SignInEventTypes": [
    "nonInteractiveUser"
  ],
  "Status": {
    "errorCode": 0,
    "additionalDetails": "MFA requirement satisfied by claim in the token"
  },
  "TokenIssuerType": "AzureAD",
  "TokenProtectionStatusDetails": {
    "signInSessionStatus": "none",
    "signInSessionStatusCode": 1002
  },
  "UniqueTokenIdentifier": "E2IpbcpM4EqC_bX6gW4fAA",
  "UserDisplayName": "Admin User",
  "UserId": "aaaaaaaa-0000-0000-0000-000000000001",
  "UserPrincipalName": "adminuser@example.onmicrosoft.com",
  "UserType": "Member"
}

Target application: Sign-in naming a target application

Description

Record carrying AppDisplayName, AppId, or ResourceDisplayName: the application and OAuth resource the cached-token or client-credential request targeted.

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppDisplayName": "O365 Demeter",
  "AppId": "982bda36-4632-4165-a46a-9863b1bbcf7d",
  "AppOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "AppliedEventListeners": "None",
  "AuthenticationContextClassReferences": [],
  "AuthenticationDetails": [
    {
      "authenticationStepDateTime": "2026-07-25T15:55:22.4071391+00:00",
      "authenticationMethod": "Previously satisfied",
      "authenticationMethodDetail": "",
      "succeeded": true,
      "authenticationStepResultDetail": "MFA requirement satisfied by claim in the token",
      "authenticationStepRequirement": ""
    }
  ],
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Oauth Scope Info",
      "value": [
        "user_impersonation"
      ]
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "False"
    }
  ],
  "AuthenticationProtocol": "none",
  "AuthenticationRequirement": "multiFactorAuthentication",
  "AuthenticationRequirementPolicies": [
    {
      "requirementProvider": "securityDefaults",
      "detail": "Security Defaults"
    }
  ],
  "AutonomousSystemNumber": "64512",
  "Category": "NonInteractiveUserSignInLogs",
  "ClientAppUsed": "Browser",
  "ClientCredentialType": "clientAssertion",
  "ConditionalAccessAudiences": [
    "982bda36-4632-4165-a46a-9863b1bbcf7d",
    "1514f0a7-c9d3-4ce3-9048-73e754767b8d"
  ],
  "ConditionalAccessPolicies": [
    {
      "id": "SecurityDefaults",
      "displayName": "Security Defaults",
      "enforcedGrantControls": [
        "Mfa"
      ],
      "result": "success",
      "conditionsSatisfied": 3,
      "conditionsNotSatisfied": 0
    }
  ],
  "ConditionalAccessPoliciesV2": "None",
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "224035f5-5660-456a-80ae-e0bb9fa87a15",
  "CreatedDateTime": "2026-07-25T15:55:22.4071391Z",
  "CrossTenantAccessType": "none",
  "DeviceDetail": {
    "deviceId": "",
    "operatingSystem": "MacOs",
    "browser": "Rich Client 203.0.113.10",
    "isCompliant": false,
    "isManaged": false
  },
  "DurationMs": "0",
  "HomeTenantId": "11111111-1111-1111-1111-111111111111",
  "IPAddress": "2001:db8::10",
  "Id": "6d296213-4cca-4ae0-82fd-b5fa816e1f00",
  "Identity": "Admin User",
  "IncomingTokenType": "none",
  "IsInteractive": "False",
  "IsRisky": "None",
  "IsTenantRestricted": "False",
  "IsThroughGlobalSecureAccess": "False",
  "Location": "US",
  "LocationDetails": {
    "city": "Redacted",
    "state": "Redacted",
    "countryOrRegion": "US",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "OriginalRequestId": "6d296213-4cca-4ae0-82fd-b5fa816e1f00",
  "OriginalTransferMethod": "none",
  "ProcessingTimeInMs": "101",
  "ResourceDisplayName": "M365 Commerce Management",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceIdentity": "1514f0a7-c9d3-4ce3-9048-73e754767b8d",
  "ResourceTenantId": "11111111-1111-1111-1111-111111111111",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "RiskDetail": "none",
  "RiskEventTypes": [],
  "RiskLevelAggregated": "none",
  "RiskLevelDuringSignIn": "none",
  "RiskState": "none",
  "ServicePrincipalId": "f3a67490-8317-417b-b3e6-3aa07d654618",
  "SessionId": "0022840a-e4ab-884c-587f-d20d24637227",
  "SessionLifetimePolicies": [],
  "SignInEventTypes": [
    "nonInteractiveUser"
  ],
  "Status": {
    "errorCode": 0,
    "additionalDetails": "MFA requirement satisfied by claim in the token"
  },
  "TokenIssuerType": "AzureAD",
  "TokenProtectionStatusDetails": {
    "signInSessionStatus": "none",
    "signInSessionStatusCode": 1002
  },
  "UniqueTokenIdentifier": "E2IpbcpM4EqC_bX6gW4fAA",
  "UserDisplayName": "Admin User",
  "UserId": "aaaaaaaa-0000-0000-0000-000000000001",
  "UserPrincipalName": "adminuser@example.onmicrosoft.com",
  "UserType": "Member"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`azure_ad::app_id` (elastic rule field)	eq	`29d9ed98-a469-4536-ade2-f981bc1d605e`	3 rules	elastic
`AppId` (kusto rule field)	eq	`FociClientApplications`	2 rules	kusto
`HomeTenantId` (kusto rule field)	cross_field_compare	`ResourceTenantId`	2 rules	kusto
`IncomingTokenType` (kusto rule field)	eq	`none`	2 rules	kusto
`IncomingTokenType` (kusto rule field)	ne	`none`	2 rules	kusto
`SecondAppDisplayName` (kusto rule field)	in	`Microsoft Azure CLI`	2 rules	kusto
`SecondAppDisplayName` (kusto rule field)	in	`Microsoft Azure PowerShell`	2 rules	kusto
`azure.signinlogs.properties.device_detail.is_managed` (elastic rule field)	ne	`true`	2 rules	elastic
`azure.signinlogs.properties.incoming_token_type` (elastic rule field)	eq	`primaryRefreshToken`	2 rules	elastic
`azure.signinlogs.properties.incoming_token_type` (elastic rule field)	eq	`refreshToken`	2 rules	elastic
`azure.signinlogs.properties.token_protection_status_details.sign_in_session_status` (elastic rule field)	eq	`unbound`	2 rules	elastic
`azure.signinlogs.result_signature` (elastic rule field)	eq	`SUCCESS`	2 rules	elastic
`azure_ad::resource_display_name` (elastic rule field)	ne	`Device Registration Service`	2 rules	elastic
`azure_ad::signin_category` (elastic rule field)	eq	`NonInteractiveUserSignInLogs`	2 rules	elastic
`azure_ad::user_type` (elastic rule field)	eq	`Member`	2 rules	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Entra ID OAuth PRT Issuance to Non-Managed Device Detected source medium: Identifies when a user signs in with a refresh token using the Microsoft Authentication Broker (MAB) client, followed by a Primary Refresh Token (PRT) sign-in from the same device within 1 hour from an unmanaged device. This pattern may indicate that an attacker has successfully registered a device using ROADtx and transitioned from short-term token access to long-term persistent access via PRTs. Excluding access to the Device Registration Service (DRS) ensures the PRT is being used beyond registration, often to access Microsoft 365 resources like Outlook or SharePoint.T1078, T1078.004, T1098, T1098.005, T1528, T1550
Entra ID ADRS Token Request by Microsoft Authentication Broker source medium: Detects suspicious OAuth 2.0 token requests where the Microsoft Authentication Broker (29d9ed98-a469-4536-ade2-f981bc1d605e) requests access to the Device Registration Service (01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9) on behalf of a user principal. The presence of the adrs_access scope in the authentication processing details suggests an attempt to access ADRS, which is atypical for standard user sign-ins. This behavior may reflect an effort to abuse device registration for unauthorized persistence, such as acquiring a Primary Refresh Token (PRT) or establishing a trusted session.T1098, T1098.005, T1550
Entra ID Sign-in Brute Force Attempted (Microsoft 365) source medium: Identifies potential brute-force attacks targeting Microsoft 365 user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to Microsoft 365 services such as Exchange Online, SharePoint, or Teams.T1110, T1110.001, T1110.003, T1110.004↳ also matches Invalid-credentials: Sign-in with invalid credentials, Password-expired: Sign-in blocked by expired password, Disabled: Sign-in attempted against a disabled account, MFA-challenged: Sign-in with an incomplete or failed MFA challenge, Other: Sign-in with another recorded result

Show 1 more (4 total) on the rules page

Kusto #

Detect entra token request via specific BOF (IOC based) source: This might be one of the silliest detections I have created. But since there is a Beacon Object File out there which can be used to directly request Entra ID access tokens from an active beacon on a device using a specific User Agent, we can easily detect this beacon file by flagging the funny user agent and / or scope identifier that is used.T1606, T1651
Detect suspicious foci token logins source: FOCI tokens (Family of Client IDs tokens) are special refresh tokens that allow multiple applications within the same "family" to share authentication tokens. This means that once a user authenticates with one application, they can access other applications in the same family without needing to re-authenticate. For adversaries, these are very interesting tokens to abuse since they can access a normal application (Microsoft Teams for example), and reuse that refresh token to access another application (like Azure CLI). To detect a suspicious foci token combination, we look for all the logins using foci tokens and group them by Session ID (since these belong to the same session). Then we take the first login where no refresh token was provided, and look at the logins that used refresh tokens as incomming token types within that same session. If the second login application is one that is typically abused by adversaries and the application for the first login is a 'normal' application, we flag the event. We added a second version for this query in this repo, to also flag when an adversary is using the same application to get new access tokens but with another scope. The v2 version focusses more on RoadTool detection tho, while this detection is more broad. Some organizations have a high BP hit count on Microsoft Azure CLI. To limit those hits, you have three finetune options to enable in the query: - Only alert when first and second login has X time between each other (default 90 minutes if enabled) - Only alert on Microsoft Azure CLI when Global Administrator scope is used in token - Only alert on Microsoft Azure CLI when Global Administrator scope is used in token and request came from a non-compliant deviceT1606, T1651
Detect suspicious foci token logins V2 source: FOCI tokens (Family of Client IDs tokens) are special refresh tokens that allow multiple applications within the same "family" to share authentication tokens. This means that once a user authenticates with one application, they can access other applications in the same family without needing to re-authenticate. For adversaries, these are very interesting tokens to abuse since they can access a normal application (Microsoft Teams for example), and reuse that refresh token to access another application (like Azure CLI). To detect a suspicious foci token combination, we look for all the logins using foci tokens and group them by Session ID (since these belong to the same session). Then we take the first login where no refresh token was provided, and look at the logins that used refresh tokens as incomming token types within that same session. If the second login application is one that is typically abused by adversaries and the application for the first login is a 'normal' application, we flag the event. This version is the V2 version for this query in this repo, which also flags when an adversary is using the same application to get new access tokens but with another scope (compared to V1 which does not do this). The v2 version focusses more on RoadTool detection tho, while the v1 detection is more broad. Some organizations have a high BP hit count on Microsoft Azure CLI. To limit those hits, you have three finetune options to enable in the query: - Only alert when first and second login has X time between each other (default 90 minutes if enabled) - Only alert on Microsoft Azure CLI when Global Administrator scope is used in token - Only alert on Microsoft Azure CLI when Global Administrator scope is used in token and request came from a non-compliant deviceT1606, T1651

Authentication requirement: Sign-in recording an authentication requirement

Description

Record carrying AuthenticationRequirement (multiFactorAuthentication or singleFactorAuthentication): whether an MFA step was required for the flow.

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppDisplayName": "O365 Demeter",
  "AppId": "982bda36-4632-4165-a46a-9863b1bbcf7d",
  "AppOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "AppliedEventListeners": "None",
  "AuthenticationContextClassReferences": [],
  "AuthenticationDetails": [
    {
      "authenticationStepDateTime": "2026-07-25T15:55:22.4071391+00:00",
      "authenticationMethod": "Previously satisfied",
      "authenticationMethodDetail": "",
      "succeeded": true,
      "authenticationStepResultDetail": "MFA requirement satisfied by claim in the token",
      "authenticationStepRequirement": ""
    }
  ],
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Oauth Scope Info",
      "value": [
        "user_impersonation"
      ]
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "False"
    }
  ],
  "AuthenticationProtocol": "none",
  "AuthenticationRequirement": "multiFactorAuthentication",
  "AuthenticationRequirementPolicies": [
    {
      "requirementProvider": "securityDefaults",
      "detail": "Security Defaults"
    }
  ],
  "AutonomousSystemNumber": "64512",
  "Category": "NonInteractiveUserSignInLogs",
  "ClientAppUsed": "Browser",
  "ClientCredentialType": "clientAssertion",
  "ConditionalAccessAudiences": [
    "982bda36-4632-4165-a46a-9863b1bbcf7d",
    "1514f0a7-c9d3-4ce3-9048-73e754767b8d"
  ],
  "ConditionalAccessPolicies": [
    {
      "id": "SecurityDefaults",
      "displayName": "Security Defaults",
      "enforcedGrantControls": [
        "Mfa"
      ],
      "result": "success",
      "conditionsSatisfied": 3,
      "conditionsNotSatisfied": 0
    }
  ],
  "ConditionalAccessPoliciesV2": "None",
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "224035f5-5660-456a-80ae-e0bb9fa87a15",
  "CreatedDateTime": "2026-07-25T15:55:22.4071391Z",
  "CrossTenantAccessType": "none",
  "DeviceDetail": {
    "deviceId": "",
    "operatingSystem": "MacOs",
    "browser": "Rich Client 203.0.113.10",
    "isCompliant": false,
    "isManaged": false
  },
  "DurationMs": "0",
  "HomeTenantId": "11111111-1111-1111-1111-111111111111",
  "IPAddress": "2001:db8::10",
  "Id": "6d296213-4cca-4ae0-82fd-b5fa816e1f00",
  "Identity": "Admin User",
  "IncomingTokenType": "none",
  "IsInteractive": "False",
  "IsRisky": "None",
  "IsTenantRestricted": "False",
  "IsThroughGlobalSecureAccess": "False",
  "Location": "US",
  "LocationDetails": {
    "city": "Redacted",
    "state": "Redacted",
    "countryOrRegion": "US",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "OriginalRequestId": "6d296213-4cca-4ae0-82fd-b5fa816e1f00",
  "OriginalTransferMethod": "none",
  "ProcessingTimeInMs": "101",
  "ResourceDisplayName": "M365 Commerce Management",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceIdentity": "1514f0a7-c9d3-4ce3-9048-73e754767b8d",
  "ResourceTenantId": "11111111-1111-1111-1111-111111111111",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "RiskDetail": "none",
  "RiskEventTypes": [],
  "RiskLevelAggregated": "none",
  "RiskLevelDuringSignIn": "none",
  "RiskState": "none",
  "ServicePrincipalId": "f3a67490-8317-417b-b3e6-3aa07d654618",
  "SessionId": "0022840a-e4ab-884c-587f-d20d24637227",
  "SessionLifetimePolicies": [],
  "SignInEventTypes": [
    "nonInteractiveUser"
  ],
  "Status": {
    "errorCode": 0,
    "additionalDetails": "MFA requirement satisfied by claim in the token"
  },
  "TokenIssuerType": "AzureAD",
  "TokenProtectionStatusDetails": {
    "signInSessionStatus": "none",
    "signInSessionStatusCode": 1002
  },
  "UniqueTokenIdentifier": "E2IpbcpM4EqC_bX6gW4fAA",
  "UserDisplayName": "Admin User",
  "UserId": "aaaaaaaa-0000-0000-0000-000000000001",
  "UserPrincipalName": "adminuser@example.onmicrosoft.com",
  "UserType": "Member"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`azure_ad::authentication_requirement` (elastic rule field)	eq	`singlefactorauthentication`	2 rules	elastic
`azure_ad::signin_category` (elastic rule field)	in	`noninteractiveusersigninlogs`	2 rules	elastic
`azure_ad::signin_category` (elastic rule field)	in	`signinlogs`	2 rules	elastic
`event.outcome` (elastic rule field)	eq	`failure`	2 rules	elastic
`Esql.brute_force_type` (elastic rule field)	ne	`other`	1 rule	elastic
`source.as.organization.name` (elastic rule field)	ne	`microsoft-corp-msn-as-block`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Entra ID User Sign-in Brute Force Attempted source medium: Identifies potential brute-force attacks targeting user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to applications integrated with Entra ID or to compromise valid user accounts.T1110, T1110.001, T1110.003, T1110.004↳ also matches Invalid-credentials: Sign-in with invalid credentials, Password-expired: Sign-in blocked by expired password, Disabled: Sign-in attempted against a disabled account, MFA-challenged: Sign-in with an incomplete or failed MFA challenge, Other: Sign-in with another recorded result
Entra ID Excessive Account Lockouts Detected source high: Identifies a high count of failed Microsoft Entra ID sign-in attempts as the result of the target user account being locked out. Adversaries may attempt to brute-force user accounts by repeatedly trying to authenticate with incorrect credentials, leading to account lockouts by Entra ID Smart Lockout policies.T1110, T1110.001, T1110.003, T1110.004↳ also matches Account-locked: Sign-in blocked by account lockout

Conditional Access status: Sign-in recording a Conditional Access status

Description

Record carrying ConditionalAccessStatus: the status of every Conditional Access policy related to the sign-in.

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppDisplayName": "O365 Demeter",
  "AppId": "982bda36-4632-4165-a46a-9863b1bbcf7d",
  "AppOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "AppliedEventListeners": "None",
  "AuthenticationContextClassReferences": [],
  "AuthenticationDetails": [
    {
      "authenticationStepDateTime": "2026-07-25T15:55:22.4071391+00:00",
      "authenticationMethod": "Previously satisfied",
      "authenticationMethodDetail": "",
      "succeeded": true,
      "authenticationStepResultDetail": "MFA requirement satisfied by claim in the token",
      "authenticationStepRequirement": ""
    }
  ],
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Oauth Scope Info",
      "value": [
        "user_impersonation"
      ]
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "False"
    }
  ],
  "AuthenticationProtocol": "none",
  "AuthenticationRequirement": "multiFactorAuthentication",
  "AuthenticationRequirementPolicies": [
    {
      "requirementProvider": "securityDefaults",
      "detail": "Security Defaults"
    }
  ],
  "AutonomousSystemNumber": "64512",
  "Category": "NonInteractiveUserSignInLogs",
  "ClientAppUsed": "Browser",
  "ClientCredentialType": "clientAssertion",
  "ConditionalAccessAudiences": [
    "982bda36-4632-4165-a46a-9863b1bbcf7d",
    "1514f0a7-c9d3-4ce3-9048-73e754767b8d"
  ],
  "ConditionalAccessPolicies": [
    {
      "id": "SecurityDefaults",
      "displayName": "Security Defaults",
      "enforcedGrantControls": [
        "Mfa"
      ],
      "result": "success",
      "conditionsSatisfied": 3,
      "conditionsNotSatisfied": 0
    }
  ],
  "ConditionalAccessPoliciesV2": "None",
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "224035f5-5660-456a-80ae-e0bb9fa87a15",
  "CreatedDateTime": "2026-07-25T15:55:22.4071391Z",
  "CrossTenantAccessType": "none",
  "DeviceDetail": {
    "deviceId": "",
    "operatingSystem": "MacOs",
    "browser": "Rich Client 203.0.113.10",
    "isCompliant": false,
    "isManaged": false
  },
  "DurationMs": "0",
  "HomeTenantId": "11111111-1111-1111-1111-111111111111",
  "IPAddress": "2001:db8::10",
  "Id": "6d296213-4cca-4ae0-82fd-b5fa816e1f00",
  "Identity": "Admin User",
  "IncomingTokenType": "none",
  "IsInteractive": "False",
  "IsRisky": "None",
  "IsTenantRestricted": "False",
  "IsThroughGlobalSecureAccess": "False",
  "Location": "US",
  "LocationDetails": {
    "city": "Redacted",
    "state": "Redacted",
    "countryOrRegion": "US",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "OriginalRequestId": "6d296213-4cca-4ae0-82fd-b5fa816e1f00",
  "OriginalTransferMethod": "none",
  "ProcessingTimeInMs": "101",
  "ResourceDisplayName": "M365 Commerce Management",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceIdentity": "1514f0a7-c9d3-4ce3-9048-73e754767b8d",
  "ResourceTenantId": "11111111-1111-1111-1111-111111111111",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "RiskDetail": "none",
  "RiskEventTypes": [],
  "RiskLevelAggregated": "none",
  "RiskLevelDuringSignIn": "none",
  "RiskState": "none",
  "ServicePrincipalId": "f3a67490-8317-417b-b3e6-3aa07d654618",
  "SessionId": "0022840a-e4ab-884c-587f-d20d24637227",
  "SessionLifetimePolicies": [],
  "SignInEventTypes": [
    "nonInteractiveUser"
  ],
  "Status": {
    "errorCode": 0,
    "additionalDetails": "MFA requirement satisfied by claim in the token"
  },
  "TokenIssuerType": "AzureAD",
  "TokenProtectionStatusDetails": {
    "signInSessionStatus": "none",
    "signInSessionStatusCode": 1002
  },
  "UniqueTokenIdentifier": "E2IpbcpM4EqC_bX6gW4fAA",
  "UserDisplayName": "Admin User",
  "UserId": "aaaaaaaa-0000-0000-0000-000000000001",
  "UserPrincipalName": "adminuser@example.onmicrosoft.com",
  "UserType": "Member"
}

Client app (legacy authentication): Sign-in from a named client app (legacy authentication signal)

Description

Record carrying ClientAppUsed: app auth details distinguishing legacy clients (Exchange ActiveSync and other older clients) from modern browser-based clients.

Example Sign-in Log Entry #

{
  "AADTenantId": "11111111-1111-1111-1111-111111111111",
  "Agent": {
    "agentType": "notAgentic",
    "agentSubjectType": "notAgentic"
  },
  "AppDisplayName": "O365 Demeter",
  "AppId": "982bda36-4632-4165-a46a-9863b1bbcf7d",
  "AppOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
  "AppliedEventListeners": "None",
  "AuthenticationContextClassReferences": [],
  "AuthenticationDetails": [
    {
      "authenticationStepDateTime": "2026-07-25T15:55:22.4071391+00:00",
      "authenticationMethod": "Previously satisfied",
      "authenticationMethodDetail": "",
      "succeeded": true,
      "authenticationStepResultDetail": "MFA requirement satisfied by claim in the token",
      "authenticationStepRequirement": ""
    }
  ],
  "AuthenticationProcessingDetails": [
    {
      "key": "Legacy TLS (TLS 1.0, 1.1, 3DES)",
      "value": "False"
    },
    {
      "key": "Oauth Scope Info",
      "value": [
        "user_impersonation"
      ]
    },
    {
      "key": "Is Legacy Store Used",
      "value": "False"
    },
    {
      "key": "Is CAE Token",
      "value": "False"
    }
  ],
  "AuthenticationProtocol": "none",
  "AuthenticationRequirement": "multiFactorAuthentication",
  "AuthenticationRequirementPolicies": [
    {
      "requirementProvider": "securityDefaults",
      "detail": "Security Defaults"
    }
  ],
  "AutonomousSystemNumber": "64512",
  "Category": "NonInteractiveUserSignInLogs",
  "ClientAppUsed": "Browser",
  "ClientCredentialType": "clientAssertion",
  "ConditionalAccessAudiences": [
    "982bda36-4632-4165-a46a-9863b1bbcf7d",
    "1514f0a7-c9d3-4ce3-9048-73e754767b8d"
  ],
  "ConditionalAccessPolicies": [
    {
      "id": "SecurityDefaults",
      "displayName": "Security Defaults",
      "enforcedGrantControls": [
        "Mfa"
      ],
      "result": "success",
      "conditionsSatisfied": 3,
      "conditionsNotSatisfied": 0
    }
  ],
  "ConditionalAccessPoliciesV2": "None",
  "ConditionalAccessStatus": "notApplied",
  "CorrelationId": "224035f5-5660-456a-80ae-e0bb9fa87a15",
  "CreatedDateTime": "2026-07-25T15:55:22.4071391Z",
  "CrossTenantAccessType": "none",
  "DeviceDetail": {
    "deviceId": "",
    "operatingSystem": "MacOs",
    "browser": "Rich Client 203.0.113.10",
    "isCompliant": false,
    "isManaged": false
  },
  "DurationMs": "0",
  "HomeTenantId": "11111111-1111-1111-1111-111111111111",
  "IPAddress": "2001:db8::10",
  "Id": "6d296213-4cca-4ae0-82fd-b5fa816e1f00",
  "Identity": "Admin User",
  "IncomingTokenType": "none",
  "IsInteractive": "False",
  "IsRisky": "None",
  "IsTenantRestricted": "False",
  "IsThroughGlobalSecureAccess": "False",
  "Location": "US",
  "LocationDetails": {
    "city": "Redacted",
    "state": "Redacted",
    "countryOrRegion": "US",
    "geoCoordinates": {
      "latitude": 0.0,
      "longitude": 0.0
    }
  },
  "OperationName": "Sign-in activity",
  "OperationVersion": "1.0",
  "OriginalRequestId": "6d296213-4cca-4ae0-82fd-b5fa816e1f00",
  "OriginalTransferMethod": "none",
  "ProcessingTimeInMs": "101",
  "ResourceDisplayName": "M365 Commerce Management",
  "ResourceGroup": "Microsoft.aadiam",
  "ResourceIdentity": "1514f0a7-c9d3-4ce3-9048-73e754767b8d",
  "ResourceTenantId": "11111111-1111-1111-1111-111111111111",
  "ResultSignature": "SUCCESS",
  "ResultType": "0",
  "RiskDetail": "none",
  "RiskEventTypes": [],
  "RiskLevelAggregated": "none",
  "RiskLevelDuringSignIn": "none",
  "RiskState": "none",
  "ServicePrincipalId": "f3a67490-8317-417b-b3e6-3aa07d654618",
  "SessionId": "0022840a-e4ab-884c-587f-d20d24637227",
  "SessionLifetimePolicies": [],
  "SignInEventTypes": [
    "nonInteractiveUser"
  ],
  "Status": {
    "errorCode": 0,
    "additionalDetails": "MFA requirement satisfied by claim in the token"
  },
  "TokenIssuerType": "AzureAD",
  "TokenProtectionStatusDetails": {
    "signInSessionStatus": "none",
    "signInSessionStatusCode": 1002
  },
  "UniqueTokenIdentifier": "E2IpbcpM4EqC_bX6gW4fAA",
  "UserDisplayName": "Admin User",
  "UserId": "aaaaaaaa-0000-0000-0000-000000000001",
  "UserPrincipalName": "adminuser@example.onmicrosoft.com",
  "UserType": "Member"
}

Non-interactive User Sign-in Logs

any: Sign-in record (AADNonInteractiveUserSignInLogs, any result)

Description

Example Sign-in Log Entry #

Common Indicators #

Related events #

Detection Rules #

Elastic #

Splunk #

Kusto #

YARA-L #

Panther #

Success: Successful sign-in

Description

Example Sign-in Log Entry #

Common Indicators #

Related events #

Detection Rules #

Elastic #

Splunk #

Kusto #

Invalid-credentials: Sign-in with invalid credentials

Description

Common Indicators #

Related events #

Detection Rules #

Elastic #

Account-locked: Sign-in blocked by account lockout

Description

Related events #

Detection Rules #

Elastic #

Password-expired: Sign-in blocked by expired password

Description

Common Indicators #

Related events #

Detection Rules #

Elastic #

Disabled: Sign-in attempted against a disabled account

Description

Common Indicators #

Related events #

Detection Rules #

Elastic #

MFA-challenged: Sign-in with an incomplete or failed MFA challenge

Description

Common Indicators #

Related events #

Detection Rules #

Elastic #

Kusto #

Blocked-by-CA: Sign-in blocked by Conditional Access

Description

Other: Sign-in with another recorded result

Description

Example Sign-in Log Entry #

Common Indicators #

Related events #

Detection Rules #

Elastic #

Identity Protection (risk): Sign-in with an Identity Protection risk assessment

Description

Example Sign-in Log Entry #

Target application: Sign-in naming a target application

Description

Example Sign-in Log Entry #

Common Indicators #

Related events #

Detection Rules #

Elastic #

Kusto #

Authentication requirement: Sign-in recording an authentication requirement

Description

Example Sign-in Log Entry #

Common Indicators #

Related events #

Detection Rules #

Elastic #

Conditional Access status: Sign-in recording a Conditional Access status

Description